Jellyfin 12.0 ships security fixes for path traversal, setup bypass, and web client XSS; legacy /emby/ and /mediabrowser/ logins removed

Jellyfin 12.0 blocks crafted requests from reading files outside served directories, prevents unauthorized re-runs of the first-run setup wizard, rejects unsafe plugin package names, and fixes web client XSS, with no CVE IDs or severity ratings published. The…

Both reports, published 2026-09-08, cover the Jellyfin 12.0 open-source media server release and do not conflict on any point. Merged security fixes: blocking crafted requests that reach or read files outside served directories (described as path traversal by Help Net Security and unauthorized file access by GBHackers), preventing unauthorized re-runs of the first-run setup wizard on misconfigured servers, rejecting plugin packages with unsafe names, and fixing web client cross-site scripting affecting browser-based administration and media access workflows. GBHackers additionally cites strengthened parental control enforcement. Help Net Security reports that the project published no CVE identifiers or severity ratings for these fixes, and GBHackers cites none either. Beyond security, 12.0 removes the legacy /emby/ and /mediabrowser/ endpoints, disables deprecated authentication by default, and targets .NET 10, requiring third-party plugin rebuilds (10.11-era plugins break) and regeneration of SDKs and integrations; the server now reports version 12.0.0. Upgrades are supported only from 10.10.7 or any 10.11.x. The database schema migration is irreversible, so a manual backup is required first; duplicate case-insensitive usernames will break migration, a full library rescan is needed afterward, and automatically grouped versions are reconstructed from disk. Built-in TLS removal was postponed to a future version (Help Net Security), and both reports advise that internet-exposed deployments should still sit behind a reverse proxy.

• Affected software: Jellyfin open-source media server; fixed release version 12.0 (server reports 12.0.0)
• Both reports published 2026-09-08 (Help Net Security, GBHackers); the reports do not conflict on any point
• Security fix: path traversal / unauthorized file access via crafted requests reaching files outside served directories
• Security fix: unauthorized re-runs of the first-run setup wizard blocked on misconfigured servers
• Security fix: plugin packages with unsafe names now rejected
• Security fix: web client XSS fixed in browser-based administration and media access workflows
• No CVE identifiers or severity ratings published for these fixes (Help Net Security; GBHackers cites none)
• GBHackers additionally reports strengthened parental control enforcement in 12.0